System and method for automated anti-viral file update

ABSTRACT

A method and system for updating virus signature files of a computer system. The method includes the steps of storing first update data on a storage medium including second update data to be installed to the computer system, and installing the second update data to the computer system wherein the first update data includes virus signature updating data. The system includes: a least one computer and the portable storage medium adapted to deliver data to the at least one computer. The portable storage medium includes first and second data wherein the first data includes virus signature update data.

TECHNICAL FIELD

The present invention relates generally to a system and method fordetecting computer viruses, and more particularly to a system and methodfor updating the antivirus files of a computer system.

BACKGROUND OF THE INVENTION

The field of computers has been plagued over the years with computerviruses. A computer virus is a program that is executed without theknowledge or authorization of the user of the computer--the virustypically performing unauthorized and undesirable actions on componentsof the computer and/or information stored on the computer.

These programs are often introduced for malicious reasons, andfrequently result in substantial damage to the computer and/or datastored on the computer. For example, some viruses alter or destroy datastored on the computer hard drive, scramble characters on video displayscreens, consume computer or network resources, oftentimes resulting inconsiderable downtime for the computer user and his office. In lessserious cases, an attack by a computer virus may force an organizationto replicate or recover data and files before it can resume normaloperation. In more serious cases, data and files destroyed by a virusmay become unrecoverable, forever shutting down that aspect of theorganization's operations. Additionally, in some cases the integrity ofan organization's data bases may have been attacked without warning, andthe organization continues operation using inaccurate data, possiblyresulting in injuries, losses and damages.

Computer viruses have the particular property of being able to replicatethemselves and thus spread from one computer file to another, onecomputer volume to another, and one machine to another. The viruses maybe spread in a number of ways. For example, a virus may spread by addingitself to code that already exists within some program on a computer,then changing that preexisting code in such a way that the newly addedviral code will be executed. This enables the virus to execute again andreplicate itself in yet another program.

Viruses typically propagate by opportunistically copying themselves to("infecting") a disk that happens to be accessible when a computerexecutes the virus. If a user transports an infected disk to a secondcomputer and the second computer executes the virus, the virus thenattempts to infect disks on the second computer, and so on.

Many software solutions have been devised to help counter these virusessuch as for example virus scanner programs. The virus scanner programscans a file or set of files for particular known viruses. Typically,these "anti-virus" programs both detect and remove known viruses. Theanti-virus program searches for "signatures", including characteristicbehaviors of viruses and removes any found virus. These programs aregenerally successful at eliminating the viruses that are known to thescanner program. However, viruses are oftentimes created by maliciouscomputer hackers who are continuously producing new and more damagingcomputer viruses. It is estimated that at least several new viruses areintroduced each day.

Although the virus detection programs are good at detecting andeliminating viruses, they are limited in that they can generally onlydetect viruses known to them via their virus signature files. Theanti-virus program relies on a fairly extensive library of knowncomputer viruses. As a result, new viruses with signatures not listed inthe virus signature files of a computer oftentimes will go byundetected. Thus, signature scanning programs require frequent updatesto keep them current with the increasing number of viruses. If theantivirus developer is lax in providing updates, or the user is lax inobtaining and employing available updates, a signature scanninganti-virus program can rapidly lose its effectiveness. Consequently, thenew virus may be able to damage the computer and/or the informationstored thereon. Therefore, a conventional virus detection program maybecome obsolete within only a few months after installation.

Furthermore, the aforementioned updating problem is not solely limitedto virus signature files but also is prevalent in other areas whereparticular software utilizes reference files that need to be updatedfrequently in order for the system using the software to operate at peakefficiency.

Accordingly, in light of the above, there is a strong need in the artfor an improved system and method for updating the virus signature filesof a computer and/or computer system without putting the onus ofupdating on the user so that an anti-virus program stored thereon willbe able to detect and eliminate viruses including newly created ones.Moreover, there is a strong need in the art for an improved system andmethod for updating reference files of a computer and/or computer systemwithout putting the onus of updating on the user.

SUMMARY OF THE INVENTION

The present invention in particular relates to a system and method forupdating virus signature files of a computer and/or computer system sothat an anti-virus program stored thereon will be able to detect andeliminate viruses including newly created ones. However, as will bediscussed below, the present invention has applicability to updatingreference files of a computer and/or computer system without putting theonus of updating on the user.

Briefly, the present invention provides a set of virus signatures fileson a storage medium such as a floppy disk or CD-ROM that is being usedto install a program, files or other data to a computer or computersystem. Along with the program or data being installed, the virussignature update files are also provided to the computer or computersystem. The virus signature update files being downloaded include themost recently available signatures for known viruses. The computer orcomputer system receiving the files updates its current virus signaturefiles to include any new virus signatures that are being downloaded. Asa result, whenever, an anti-virus program is executed by the computer orcomputer system, it will be able to detect new types of viruses via thenewly added virus signatures.

As was mentioned above, the present invention can also be utilized toupdate any suitable reference files of a computer and/or computer systemwithout putting the onus of updating on the user.

According to embodiment of the present invention, a method for updatingvirus signature files of a computer system is provided including thesteps of: storing first and second update data on a portable storagemedium to be installed to the computer system, the first update dataincluding virus signature updating data, the second data including datathat is regularly delivered to the computer system; and installing thesecond update data to the computer system.

According to yet another embodiment of the present invention, a portablestorage medium for updating data of a computer is provided including:first and second data; wherein the first data includes virus signatureupdate data and the second data includes data that is regularlydelivered to the computer.

According another embodiment of the present invention, a computer systemis provided including: a least one computer; and a portable storagemedium adapted to deliver data to the at least one computer, theportable storage medium including first and second data; wherein thefirst data includes virus signature update data.

In accordance with yet another aspect of the invention, a method forupdating reference files of a computer system is provided including thesteps of: storing first and second update data on a portable storagemedium to be installed to the computer system, the first update dataincluding reference file updating data, the second data including datathat is regularly delivered to the computer system; and installing thesecond update data to the computer system.

To the accomplishment of the foregoing and related ends, the invention,then, comprises the features hereinafter fully described andparticularly pointed out in the claims. The following description andthe annexed drawings set forth in detail certain illustrativeembodiments of the invention. These embodiments are indicative, however,of but a few of the various ways in which the principles of theinvention may be employed. Other objects, advantages and novel featuresof the invention will become apparent from the following detaileddescription of the invention when considered in conjunction with thedrawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a computer system in accordance with thepresent invention;

FIG. 2 is a representative table diagram of virus signature files inaccordance with the present invention;

FIG. 3 is an elevation view of a portable storage medium in accordancewith the present invention;

FIG. 4 is a system flowchart illustrating one embodiment of the presentinvention; and

FIG. 5 is a system flowchart of another embodiment of the presentinvention.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

The present invention will now be described with reference to thedrawings, wherein like reference numerals are used to refer to likeelements throughout.

As is mentioned above, the present invention relates to a system andmethod for updating virus signature files of a computer and/or computersystem so that an anti-virus program stored thereon will be able todetect and eliminate viruses including newly created ones. The presentinvention provides a set of updated virus signatures files on arecording medium such as a floppy disk or CD-ROM that is being used toinstall a program, files or other data to a computer or computer system.Along with the program or data being installed, the updated virussignatures files are also provided to the computer or computer system.The virus signature files being downloaded include the most recentlyavailable signatures for known viruses. The computer or computer systemreceiving the files updates its current virus signature files to includeany new virus signatures that are being downloaded. Thus, according tothe present invention, a computer system's virus signature files areautomatically updated with the installation of new data and/or programs.The anti-virus program executed by the computer or computer system, willbe regularly updated so that it will be able to detect new types ofviruses via its newly added virus signatures.

Referring initially to FIG. 1, a detailed block diagram of a computersystem 10 is shown in accordance with the present invention. Thecomputer system 1 0 includes a central processing unit (CPU) 20 which iscoupled to a bus 22. The CPU or processor 20 can be any of a pluralityof processors, such as the 486DX/33, 486DX2/66, 486DX4/50-100,486DX4/33-100, 486DX4/33-83, p24T, Pentium 50/75, Pentium 60/90, andPentium 66/100, and other similar and compatible processors. Theprocessor 20 functions to perform various operations described herein aswell as for carrying out other operations related to the system 10. Themanner in which the processor 20 can be programmed to carry out thefunctions relating to the present invention will be readily apparent tothose having ordinary skill in the art based on the description providedherein.

The bus 22 includes a plurality of signal lines 24 for conveyingaddresses, data and controls between the CPU 20 and a number of othersystem bus components. The other system bus components include a memory28 (including a Random Access Memory (RAM) 30 and a Read Only Memory(ROM) 32) and a plurality of input/output (I/O) devices. The memory 28serves as data storage and may store appropriate operating code to beexecuted by the processor 20 for carrying out the functions describedherein.

The RAM 30 provides program instruction storage and working memory forthe CPU 20. The ROM 32 contains software instructions known as the BasicInput/Output System (BIOS) for performing interface operations with theI/O devices. Also stored in the ROM 32 is a software routine whichoperates to load a boot program from the booting device. The bootprogram will typically be executed when the computer system 10 ispowered on or when initialization of the system 10 is needed.

The I/O devices include basic devices such as data storage devices(e.g., floppy disks, tape drives, CD ROMs, hard disks, etc.). Typically,the I/O devices communicate with the CPU 20 by generating interrupts.The CPU 20 distinguishes interrupts from among the I/O devices throughindividual interrupt codes assigned thereto. Responses of the CPU 20 tothe I/O device interrupts differ, depending, among other things, on thedevices generating the interrupts. Interrupt vectors are provided todirect the CPU 20 to different interrupt handling routines.

The interrupt vectors are generated during initialization (i.e., bootup) of the computer system 10 by execution of the BIOS. Becauseresponses of the CPU 20 to device interrupts may need to be changed fromtime to time, the interrupt vectors may need to be modified from time totime in order to direct the CPU 20 to different interrupt handlingroutines. To allow for modification of the interrupt vectors, they arestored in the RAM 30 during operation of the computer system 10.

A disk control subsystem 40 birectionally couples one or more diskdrives 42 (e.g., floppy disk drives, CD-ROM drives, etc.) to the systembus 22. The disk drive 42 works in conjunction with a removable storagemedium such as a floppy diskette or CD-ROM.

A hard drive control subsystem 46 bidirectionally couples a rotatingfixed disk, or hard drive 48 to the system bus 22. The hard drivecontrol subsystem 46 and hard drive 48 provide mass storage for CPUinstructions and data.

A terminal control subsystem 56 is also coupled to the bus 22 andprovides output to a display device 58, typically a CRT monitor, andreceives inputs from a manual input device 60 such as a keyboard. Manualinput may also be provided from a pointing device such as a mouse.

A network adapter 70 is provided for coupling the system 10 to anetwork.

The components illustrated in FIG. 1 may be embodied in a personalcomputer, a portable computer, a workstation, a minicomputer, a mainframe computer, or a super computer. As such, the details of thephysical embodiment of the data processing system 10 such as structureof the bus 22 or the number of CPUs 20 that are coupled to the bus 22,is not crucial to the operation of the invention and thus is notdescribed in further detail below.

The computer system 10 scans all relevant media (e.g., files, bootrecords, memory, etc.) for the presence of known viruses in thefollowing manner. A pre-existing virus scanner is activated to searchfor a large set of patterns or signatures, each of which pertains to adifferent virus or virus family. The signature scanner operates byknowing what a target virus will look like based on the "signature" codefor that virus and then scanning for these program codes in any programrequested to be executed or otherwise requested to be scanned. As longas the signature codes are sufficiently long enough so as not to beconfused with another's program code, then positive identification isvirtually guaranteed and the request to execute the infected program canbe stopped before execution ever begins.

It is preferred (but not essential) that the virus scanner be capable ofdetecting slight variations on known viruses. Many conventional scannerspossess this capability, to a limited extent, because they search basedon short contiguous strings of bytes found in the virus. This isparticularly useful for detecting variations of known viruses because itpermits a certain number of mismatches between a string of bytes in afile being examined and the virus signature string. If a virus is found,the user is alerted, and the virus is eliminated by traditional methodssuch as restoration from backup (either automatically or manually by theuser) or disinfection (removal of the virus from all of the software ithas infected.) In general disinfection is only acceptable if the virusis found to be an exact copy of a known virus. This implies that thesystem 10 verify the identification made by the virus scanner.

As mentioned above, the virus scanner bases its search on known virussignatures. These signatures are a sequential portion of code, typicallyup to 16 bytes in length, unique to each virus. Those of skill in theart are familiar with the signatures of many known viruses, and lists ofsuch viruses (including their signature) are often published in varioustechnical bulletins, which are periodically updated.

To facilitate an efficient signature scan function, and to prevent thestored virus signatures themselves from causing false alarms, thesignatures are stored in a series of tables as illustrated in FIG. 2. Inthe preferred embodiment, the signature table is stored in the permanentmemory of the computer system 10. Each signature element 100 insignature tables 110(1) through 110(z) contain the value of one byte ofone virus signature: that is, the nth element in signature 110(1)contains the second byte in the nth virus signature, the nth element ofsignature table 110(2) contains the third byte in the zth virussignature, and so on, through the signature table 110(z). Thus, thenumber of signature tables 110 provided should equal the length of thelongest virus signature to be scanned for minus one, and the number ofsignature elements 100 in each signature table 110 should equal thenumber of virus signatures to be scanned for. Furthermore, the signatureelements 100 in the signature tables should be sorted according toascending numerical order of the corresponding virus signatures.

In order to gain access to the signature tables 110 an index table 120is preferably used. Each index element 124 of index table 120corresponds to each possible byte value 130 for the first byte type of avirus signature; the table 120 should therefore have room for 256elements which is the number of different values possible for one byteof data. The index elements 124 should be sorted in the ascending orderof the corresponding byte values 130. Each index element 124 containstwo fields: signature count field 140 which contains the number of virussignatures that begin with the corresponding byte value 130, and apointer field 150, which specifies (index n) the location in subsequenttables 110(1) through 110(z) where the elements corresponding tosignatures beginning with the byte value 130 are stored.

The foregoing data structure facilitates an efficient signature scanprocedure. When memory is scanned, the first memory byte examined isused as an index to specify an index element to 124 in index table 120.If signature count field 140 indicates that no signatures begin withthis byte, the scan process is restarted for the next byte in memory. Ifsignature count field 140 in the specified index element indicates thatone or more virus signatures do begin with the byte being examined, thenthe relevant signature elements 100, stored in signature tables 110(1)through 110(z), as determined from pointer field 150, are compared tosuccessive bytes in memory until either a complete virus signature matchis found, or until the memory being examined is fully scanned. Forpurposes of knowing when a signature match is complete, an extrasignature length table 158 is preferably provided, wherein the mthlength element 160 of the signature length table 158 contains the lengthof the virus signature corresponding to the zth elements of the table110.

Returning back to the search, main memory (which may include anyextended, expanded or other additional RAM memory included within thecomputer system 10) preferably is scanned first because there are anumber of "stealth" viruses that avoid detection by hiding in a memorybefore a program is run. Preferably, system files (such as COMMAND.COM)are also searched, as are boot strap loader records, including those onany floppy disks in place. If desired, scanning of system files and bootrecords can be skipped to improve speed, but at some loss in security.

Turning now to FIG. 3, a preferred portable storage medium 170 is shownin accordance with the present invention. The preferred storage mediumis a diskette with representative tracks 172, each track having sectorssuch as for example sector 180. In the preferred embodiment all trackscontain two additional sectors to provide for 160 KB of hiddenpartitions on an 80-track diskette. The virus signature update data isstored thereon so as to be inaccessible to some degree to conventionalprograms. By storing the update data in the hidden partitions,conventional storage capacity of the storage medium is not reduced. Thevirus signature update data is preferably stored in a compressed formand decompressed prior to installation to system 10.

The two additional sectors at the end of each track provide a rotationaldelay between the last conventional sector. The delay provides the diskdrive 42 enough time to reposition the head on the next track before thefirst sector of the next track passes under the head thereby speeding upaccess to data on the diskette. However, it will be appreciated that thepresent invention has applicability to any suitable storage medium(e.g., diskette, CD-rom, tape drive, etc.).

Referring now to FIG. 4, a flowchart that represents the generaloperations the present invention is shown. Set out below is anillustration of the update program for applying virus signaturemodifications or updates to the virus signature files 110 of the system110. The update program is in program design language from which sourcecode and machine code are derivable. In the following generaldescription of the update program, it is to be assumed that system 10 isunder mouse and keyboard device control. Moreover, it is assumed thatthe update program is invoked from a driver program contained in theoperating system which facilitates the display of all of the screenpanels, the monitoring of the keyboard 22 and the installation of theplurality of separately installable features or components of thesoftware program.

If the user has selected the prompted mode, the update program thenapplies all unapplied updates to all of the installed features orcomponents prior to returning control to the operating system. If theuser has selected the full function mode, the update program prepares ascreen panel which displays a list of all of the features or componentsof the software program installed on system 10 and respective value ofthe highest sequential update that can be applied to each of thefeatures. Thereafter, when the update program returns control to thedriver program, the driver program displays to the user on the display20 the prepared screen panel. The user is then permitted to lower any ofthe update values associated with any of the displayed features.

At step 200, in response to an initialization, or power-up signal theprocessor 20 executes a brief program stored in the ROM 32 which is anintegral part of processor 20 loading a boot loader program stored in apredetermined location of the portable storage medium 170 (i.e., disk)that is inserted in the disk drive 42. In step 210, the processor 20performs general initializations in a conventional manner, well known tothose skilled in the art. At step 220, in response to the initializationsignal, the processor 20 may load an update program, which is stored inlocations corresponding to the boot loader on the disk 170. The bootloader program then loads the system program stored on the disk 170 intothe memory of system 10 and transfers control to the systems program.The systems program identifies the target drive to load the general datastored on the disk 170. The system program also identifies the targetdrive and path to the system's virus signature files 110.

At step 230, the processor 20 prompts the user if an auto update isdesired. In this prompted mode, which is intended for use by lesssophisticated users, a method of updating the virus signature files 110with a minimum number of decisions is provided. A full function mode,which is intended to be used by sophisticated users, provides a menudriven method enabling the user to select (1) different functions of theupdate program and (2) the order of execution of the selected functions.If in step 230 the decision to auto update is yes, the processor 20proceeds to step 240. In step 240, the processor copies the new virussignature data from the disk to a memory buffer (not shown) of thesystem 10. The processor 20 in step 246 updates the virus signaturefiles 110 with the new virus signature data from the disk 170.

If in step 230, the user does not desire an auto update the processor 20proceeds to step 250. In step 250 a display menu is made available tothe user. The display menu may provide a number of user options some ofwhich are related to updating the virus signature files 110. In step260, the processor 20 determines if the virus signature update fileshave been applied. If yes, the processor 20 ends this routine andproceeds to handle other matters. If no, the processor 20 proceeds tostep 270 where the user is presented an option to supervise the updatingof the virus signature files 110. In step 280, the user is displayed thevirus signature update data from the disk 170 and is allowed to manuallyselect which new virus signatures he/she wants to apply to the virussignature files 110. It will be appreciated that brief descriptions ofthe various viruses can be coupled to the respective virus signatures inorder to facilitate the user making his/her selection.

In step 290, the processor 20 applies the user selected virus signatureupdate files and thus updates the virus signature files 110. After step290, the processor 20 returns to step 250. It will be appreciated that avariety of steps can be added to this process or even some steps removedto carry out the present invention all of which fall within the scope ofthe present invention.

FIG. 5 is a flowchart depicting another embodiment of the presentinvention. At step 300, the user inserts the storage medium 42 into acomputer that is part of the system 10. In step 310, the processor 20 ofthe computer compares the versions of virus signature update files onthe medium against the virus signature files 110 on the system 10. Ifall of the update virus signature files on the storage media are thesame or older than that stored in the virus signature files 110 on thesystem 10 the processor 20 proceeds to step 360 where it carries onroutine operations of associated with the system 10.

However, if in step 310 the processor determines that at least one ofthe virus signature update files is not found in the virus signaturefiles 110 of the system 10, the processor 20 proceeds to step 320 whereit prompts the user to decide whether to update the virus signaturefiles 110. If the user decides no, the processor 20 advances to step 360where it carries on routine operations of associated with the system 10.If the user decides that he/she does wish to update the virus signaturefiles 110, the processor 20 proceeds to step 330 where it copies the oldversions of the virus signature files 110 to a temporary buffer (to savefor use in case the update is not completed properly. Then in step 340,the processor 20 adds the virus signature updates to the virus signaturefiles 110. In this step, duplicate virus signature files are overwrittenwith the updated versions and the virus signature updates that are newto the system are added to the virus signature files 110.

The entire virus signature file 110 is not completely overwritten withthe update virus signature files since the storage medium 170 might onlycontain new virus signatures rather than a comprehensive list of allvirus signatures. Thus, an updating is preferably performed as opposedto a complete new installation of virus signature files. After step 340is complete successfully, the processor 20 in step 350 clears the bufferthen proceeds to step 360 where it carries on routine operations ofassociated with the system 10.

The present invention thus allows for a user to update the virussignature files of his/her system without having to go out of his/herway in order to update the virus signature files 110. The presentinvention may be employed in almost any environment where computers areinvolved, however, it is particularly useful in the medical industrywhere system and file integrity in critical.

For example, the present invention may be used in the cellclassification industry where speed and accuracy of cervical smearanalysis is critical. The examination of a cervical smear by what oftenis referred to as a PAP test is a mass screening cytological examinationwhich requires inspection of hundreds of thousands of cells per slide.The screening process has become automated to the extent that images aretaken of the thousands of slides. The images are stored on atransportable storage medium 170 such as a disk for review and analysisat a remote site. It is critical that the systems used in performing thecytological examinations be virus free. Otherwise, possible misdiagnosismight result which could in turn result in a person having cervicalcancer go undetected.

The present invention may be employed in this field by attaching virusupdate files to the storage medium 170 that is storing the cervicalsmear images. Thus, when the images are being downloaded at the remotesite for analysis the virus update files can be applied to the computersystem 10 of the remote site in the manner described above. Thus, inenvironments such as this where data is being regularly downloaded to asystem the present invention facilitates detection of viruses thusproviding increased protection from system and file corruption due toinfection by a computer virus.

The present invention is not limited to simply updating virus signaturefiles 110 but may also be employed in other environments where referencefiles must be meticulously updated to ensure system operatingefficiency. For example, in a business/legal environment reference filesare maintained containing benchmark data that is used in conjunctionwith various software applications. For instance in a law firm databaserules, regulations and various statutory dates and deadlines are storedin files that are referenced by software applications that use thereference data in making computations and decisions. If the referencedata is incorrect, then it is highly probable that the outputcomputation and/or decision made by the software is erroneous. Thus, ifupdate reference data were stored on a storage medium 170 in conjunctionwith regular data that is to be applied to the system 10 (in a similarmanner to that described above with respect to the virus signatureupdates), the system 10 would be using the most recent reference data.

Those skilled in the art will recognize that the embodiment describedabove and illustrated in the attached drawings are intended for purposesof illustration only and that the subject invention may be implementedin various ways. Thus, it is to be understood that the embodimentsdescribed above are not to be considered as limiting and limitations onthe subject invention are to be found only in the attached claims.

What is claimed is:
 1. A method for updating virus signature files of acomputer system comprising the steps of:storing first and second updatedata on a portable storage medium to be installed to the computersystem, the first update data including virus signature updating data,the second data including data that is regularly delivered to thecomputer system; installing the second update data to the computersystem; and prompting a user of the computer system to decide whether ornot to update the virus signature files with the first data.
 2. Themethod of claim 1 further including the step of updating the virussignature files with the first data.
 3. The method of claim 1 whereinthe storage medium is a floppy diskette.
 4. The method of claim 1wherein the storage medium is a CD-ROM.
 5. The method of claim 1 whereinthe virus signature files are automatically updated with the first datawhen the second data is being delivered to the computer system.
 6. Themethod of claim 5 wherein the first data is decompressed prior to beingused to update the virus signature files.
 7. The method of claim 1wherein the second data includes an executable software program.
 8. Themethod of claim 1 wherein the storage medium is a removable mediumadapted to be read by the computer system.
 9. The method of claim 1further including the step of the user selecting at least one portion ofthe first data to be used to update the virus signature files.
 10. Themethod of claim 1 wherein the portable storage medium further includes ahidden partition comprising storage space inaccessible to conventionalprograms and not reducing conventional storage capacity of the storagemedium, wherein the first data is stored thereon.
 11. A method forupdating virus signature files of a computer system comprising the stepsof:storing first and second update data on a portable storage medium tobe installed to the computer system, the first update data includingvirus signature updating data, the second data including data that isregularly delivered to the computer system; installing the second updatedata to the computer system; and displaying to the user a first targetdrive and directory where the virus signature files are stored.
 12. Acomputer system comprising:at least one computer; a portable storagemedium adapted to deliver data to the at least one computer, theportable storage medium including first and second data, wherein thefirst data includes virus signature data, the portable storage mediumfurther including a hidden partition comprising storage spaceinaccessible to conventional programs and not reducing conventionalstorage capacity of the storage medium, wherein the first data is storedthereon.
 13. A method for updating reference files of a computer systemcomprising the steps of:storing first and second update data on aportable storage medium to be installed to the computer system, thefirst update data including reference file updating data, the seconddata including data that is regularly delivered to the computer system,the portable storage medium further including a hidden partitioncomprising storage space inaccessible to conventional programs and notreducing conventional storage capacity of the storage medium, whereinthe first data is stored thereon; and installing the second update datato the computer system.
 14. The method of claim 13 further including thestep of updating the reference files with the data.
 15. The method ofclaim 13 wherein the reference files are automatically updated with thefirst data when the second data is being delivered to the computersystem.